better-supabase 0.12.0 → 0.13.0

package/dist/user-change-CSR_prhd.js

@@ -0,0 +1,133 @@
+//#region src/query/invalidate.ts
+function isString(value) {
+	return typeof value === "string";
+}
+function queryTables(query) {
+	const tables = query.meta?.["bsTables"];
+	if (Array.isArray(tables)) {
+		const list = tables;
+		return list.every(isString) ? list : list.filter(isString);
+	}
+	const [prefix, table] = query.queryKey;
+	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
+}
+const indexes = /* @__PURE__ */ new WeakMap();
+function indexOf(cache) {
+	const existing = indexes.get(cache);
+	if (existing) return existing;
+	const index = {
+		byTable: /* @__PURE__ */ new Map(),
+		tablesOf: /* @__PURE__ */ new Map()
+	};
+	const remove = (hash) => {
+		for (const table of index.tablesOf.get(hash) ?? []) {
+			const set = index.byTable.get(table);
+			set?.delete(hash);
+			if (set?.size === 0) index.byTable.delete(table);
+		}
+		index.tablesOf.delete(hash);
+	};
+	const add = (hash) => {
+		const query = cache.get(hash);
+		const tables = query ? queryTables(query) : void 0;
+		const known = index.tablesOf.get(hash);
+		if (known !== void 0 && tables !== void 0 && known.length === tables.length && known.every((table, at) => table === tables[at])) return;
+		remove(hash);
+		if (!tables || tables.length === 0) return;
+		index.tablesOf.set(hash, tables);
+		for (const table of tables) {
+			let set = index.byTable.get(table);
+			if (!set) index.byTable.set(table, set = /* @__PURE__ */ new Set());
+			set.add(hash);
+		}
+	};
+	for (const query of cache.getAll()) add(query.queryHash);
+	cache.subscribe((event) => {
+		const hash = event.query.queryHash;
+		if (event.type === "removed") remove(hash);
+		else if (event.type === "added" || event.type === "observerAdded" || event.type === "observerOptionsUpdated" || event.type === "updated" && event.action.type === "fetch") add(hash);
+	});
+	indexes.set(cache, index);
+	return index;
+}
+/**
+* Invalidates every query that read one of `tables`: better-supabase queries by
+* their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix. An
+* index from table to queries finds them, so a write to a table nothing read
+* skips the cache scan.
+*/
+function invalidateTables(client, tables) {
+	if (tables.length === 0) return Promise.resolve();
+	const { byTable } = indexOf(client.getQueryCache());
+	const matched = /* @__PURE__ */ new Set();
+	for (const table of tables) for (const hash of byTable.get(table) ?? []) matched.add(hash);
+	if (matched.size === 0) return Promise.resolve();
+	return client.invalidateQueries({ predicate: (query) => matched.has(query.queryHash) });
+}
+//#endregion
+//#region src/query/user-change.ts
+/**
+* Claims every refresh changes; the rest says who the caller is and what RLS
+* lets them read.
+*/
+const TIME_CLAIMS = /* @__PURE__ */ new Set([
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+]);
+/**
+* The user plus every claim except the time claims, so a token refresh keeps
+* the identity and an organization switch, a role change or a second factor (a
+* new `tenant_id`, `role` or `aal`) changes it.
+*/
+function identityKey(snapshot) {
+	if (!snapshot.user) return null;
+	const claims = Object.entries(snapshot.claims ?? {}).filter(([key]) => !TIME_CLAIMS.has(key)).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	return JSON.stringify([snapshot.user.id, claims]);
+}
+/**
+* Resets every `['bs', ...]` query when the caller changes: another user,
+* signing out, or new claims for the same user (an organization switch, a role
+* change). Mounted queries refetch, so no one sees the previous identity's
+* rows. Returns the function that stops listening. `BetterSupabaseProvider`
+* calls it for React; call it yourself with Vue, Solid, Svelte or Angular
+* Query.
+*
+* Queries that fetched while the session was still loading ran as anon, so they
+* are reset when a user arrives. Data already in the cache when loading started
+* (hydrated from the server) stays.
+*
+* ```ts
+* const stop = clearOnUserChange(queryClient, bs.auth);
+* ```
+*/
+function clearOnUserChange(queryClient, auth) {
+	let identity;
+	let before;
+	const bsQueries = () => queryClient.getQueryCache().findAll({ queryKey: ["bs"] });
+	const check = () => {
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") {
+			before ??= new Map(bsQueries().map((query) => [query.queryHash, query.state.dataUpdatedAt]));
+			return;
+		}
+		const next = identityKey(snapshot);
+		if (identity !== void 0 && identity !== next) queryClient.resetQueries({ queryKey: ["bs"] });
+		else if (identity === void 0 && next !== null && before) {
+			const known = before;
+			const fetchedAsAnon = new Set(bsQueries().filter((query) => query.state.dataUpdatedAt > 0 && known.get(query.queryHash) !== query.state.dataUpdatedAt).map((query) => query.queryHash));
+			if (fetchedAsAnon.size > 0) queryClient.resetQueries({
+				queryKey: ["bs"],
+				predicate: (query) => fetchedAsAnon.has(query.queryHash)
+			});
+		}
+		before = void 0;
+		identity = next;
+	};
+	const stop = auth.subscribe(check);
+	check();
+	return stop;
+}
+//#endregion
+export { identityKey as n, invalidateTables as r, clearOnUserChange as t };

package/dist/variants-Bat9zU8l.js

@@ -0,0 +1,53 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { n as dbError } from "./errors-D7u24ZJH.js";
+import { n as QUALITY, t as MAX_SIDE } from "./image-url-_d7xYsXK.js";
+//#region src/storage/ttl.ts
+const TTL = {
+	minute: 60,
+	hour: 3600,
+	day: 86400,
+	week: 604800
+};
+function ttlSeconds(ttl) {
+	return typeof ttl === "number" ? ttl : TTL[ttl ?? "hour"];
+}
+//#endregion
+//#region src/storage/variants.ts
+const side = (value) => value === void 0 || Number.isInteger(value) && value >= 1 && value <= 2500;
+/** Throws for a variant Storage would refuse, when the bucket is defined. */
+function checkVariants(bucketId, variants) {
+	for (const [name, transform] of Object.entries(variants)) {
+		if (!side(transform.width) || !side(transform.height)) throw new TypeError(`defineBucket("${bucketId}"): variant "${name}" needs a width and height from 1 to ${String(MAX_SIDE)}`);
+		if (transform.quality !== void 0 && (!Number.isInteger(transform.quality) || transform.quality < QUALITY.min || transform.quality > QUALITY.max)) throw new TypeError(`defineBucket("${bucketId}"): variant "${name}" needs a quality from ${String(QUALITY.min)} to ${String(QUALITY.max)}`);
+	}
+}
+/**
+* The transform a variant name stands for, or the inline transform. An unknown
+* name throws an `invalid_input` `DbException`, which the bucket methods turn
+* into an error `Result`.
+*/
+function transformFor(bucketId, variants, transform) {
+	if (typeof transform !== "string") return transform;
+	const found = Object.hasOwn(variants, transform) ? variants[transform] : void 0;
+	if (!found) throw new DbException(dbError("invalid_input", `Bucket "${bucketId}" has no image variant "${transform}"`, { table: bucketId }));
+	return found;
+}
+/**
+* The transform at `density` times its size, for a `srcset` entry. Width and
+* height scale by the same factor, which stops at Storage's 2500 limit, so a
+* crop keeps its aspect ratio.
+*/
+function scaleTransform(transform, density) {
+	const sides = [transform.width, transform.height].filter((value) => value !== void 0);
+	const factor = Math.min(density, ...sides.map((value) => MAX_SIDE / value));
+	const scale = (value) => value === void 0 ? void 0 : Math.max(1, Math.min(MAX_SIDE, Math.round(value * factor)));
+	const width = scale(transform.width);
+	const height = scale(transform.height);
+	return {
+		...transform,
+		...width === void 0 ? {} : { width },
+		...height === void 0 ? {} : { height }
+	};
+}
+//#endregion
+export { ttlSeconds as a, TTL as i, scaleTransform as n, transformFor as r, checkVariants as t };

package/dist/vault-BQThkbws.d.ts

@@ -0,0 +1,62 @@
+import { T as ErrorMapper, t as AsyncResult } from "./result-mijqfoJN.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-Dmsbl8ug.js";
+import { t as BlockTransport } from "./block-transport-DBPhgF3W.js";
+//#region src/credentials/vault.d.ts
+/** How a request the third party sends is signed with the stored secret. */
+type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";
+/**
+ * A credential in Vault. `scope: 'user'` keeps one secret per user subject. The
+ * token goes out as `<header>: <scheme> <token>`, `Authorization: Bearer` by
+ * default; `scheme: null` sends it bare (`x-api-key`).
+ */
+interface VaultCredentialRef {
+  readonly provider: "vault";
+  readonly secret: string;
+  /**
+   * Stores the secret as `tenant/<tenant>/<secret>`, apart from every other
+   * tenant's.
+   */
+  readonly tenant?: string;
+  readonly scope?: "app" | "user";
+  readonly header?: string;
+  readonly scheme?: string | null;
+  readonly inbound?: VaultInboundScheme;
+  /**
+   * Defaults to `x-hub-signature-256` for `hmac-sha256`, `authorization` for
+   * `shared-secret`.
+   */
+  readonly signatureHeader?: string;
+}
+interface VaultCredentialsOptions {
+  /**
+   * `sqlTransport(postgres.asService())` or `rpcTransport` with the service
+   * role key.
+   */
+  readonly transport: BlockTransport;
+  /** The schema of the `credentials` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /**
+   * How long a read secret stays in memory, in milliseconds. Defaults to 60000;
+   * `0` reads Vault on every call. `set` and `revoke` clear it.
+   */
+  readonly cacheMs?: number;
+}
+interface VaultCredentials extends CredentialProvider {
+  readonly name: "vault";
+  /**
+   * Stores or replaces the credential a ref names, for `subject` when the ref
+   * is per user.
+   */
+  set(ref: CredentialRef, value: string, options?: SetCredentialOptions): AsyncResult<void>;
+  verifyInbound(request: Request, ref: CredentialRef): AsyncResult<boolean>;
+}
+/**
+ * A `CredentialProvider` over the `credentials` SQL module: tokens and API keys
+ * in Supabase Vault, read through security definer functions only the service
+ * role may call. Static secrets only; OAuth connections come from a provider
+ * such as `better-supabase/vercel-connect`.
+ */
+declare function vaultCredentials(options: VaultCredentialsOptions): VaultCredentials;
+//#endregion
+export { vaultCredentials as a, VaultInboundScheme as i, VaultCredentials as n, VaultCredentialsOptions as r, VaultCredentialRef as t };

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-DXgx5oSA.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-Dmsbl8ug.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;
@@ -39,8 +39,8 @@ interface VercelConnectCredentialsOptions {
   readonly load?: () => Promise<unknown>;
 }
 /**
- * A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector,
- * for the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
+ * A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector, for
+ * the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
  */
 export declare function vercelConnectCredentials(options?: VercelConnectCredentialsOptions): CredentialProvider;
 //#endregion

package/dist/vercel-connect/index.js

@@ -1,13 +1,13 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { c as optionalTemporal } from "../temporal-CB5Fpo5d.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DIeYscA3.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
+import { c as optionalTemporal } from "../temporal-DLZlWbOi.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DIT_qp4G.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { t as importOptionalPeer } from "../optional-peer-Dx8TaYXw.js";
+import { t as importOptionalPeer } from "../optional-peer-C1NbBRJm.js";
 //#region src/vercel-connect/vercel-connect.ts
 const isModule = (value) => isRecord(value) && typeof value["getTokenResponse"] === "function" && typeof value["revokeToken"] === "function" && typeof value["startAuthorization"] === "function";
 /**
-* Loads `@vercel/connect` on first use. The specifier is a variable so
-* bundlers leave the optional peer out of apps that don't use it.
+* Loads `@vercel/connect` on first use. The specifier is a variable so bundlers
+* leave the optional peer out of apps that don't use it.
 */
 const loadConnect = () => importOptionalPeer("@vercel/connect");
 function connectRef(ref) {
@@ -32,8 +32,8 @@ function connectError(cause) {
 	}
 }
 /**
-* A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector,
-* for the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
+* A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector, for
+* the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
 */
 function vercelConnectCredentials(options = {}) {
 	let loaded;

package/dist/verify-BCmBaHlN.js

@@ -0,0 +1,130 @@
+import { n as dbError } from "./errors-D7u24ZJH.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-DLZlWbOi.js";
+import { n as temporalMissing } from "./temporal-required-Dt4mcPsi.js";
+import { a as ok, r as err } from "./result-DIT_qp4G.js";
+import { n as hmacHex, r as timingSafeEqual } from "./hmac-B3CTTlfv.js";
+import { a as unauthorized, n as header, r as replayed, s as verifyWebhook } from "./signatures-D8IoN3Rw.js";
+import { t as toApp } from "./casing-DdFWEtqr.js";
+//#region src/blocks/webhooks/verify.ts
+/** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */
+const stripeSignature = hmacHex;
+/** The `Stripe-Signature` header for `body`, for tests and local replays. */
+async function signStripeWebhook(secret, body, timestamp = nowInstant()) {
+	const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
+	return `t=${seconds},v1=${await stripeSignature(secret, `${seconds}.${body}`)}`;
+}
+/**
+* Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
+* `whsec_…` secret and parses the event. Pass several secrets while rolling the
+* endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
+*/
+async function verifyStripeWebhook(input, secrets, options = {}) {
+	const value = header(input.headers, "stripe-signature");
+	if (!value) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing Stripe-Signature header"));
+	const parts = value.split(",").map((part) => {
+		const index = part.indexOf("=");
+		return [part.slice(0, index).trim(), part.slice(index + 1).trim()];
+	});
+	const timestamp = parts.find(([name]) => name === "t")?.[1] ?? "";
+	const offered = parts.filter(([name]) => name === "v1").map(([, sig]) => sig);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const seconds = Number(timestamp);
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	if (Math.abs(now - seconds) > (options.tolerance ?? 300)) return err(unauthorized("WEBHOOK_TIMESTAMP_OUT_OF_RANGE", "Webhook timestamp is outside the tolerance"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	let valid = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const expected = await stripeSignature(secret, `${timestamp}.${body}`);
+		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+	}
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	let payload;
+	try {
+		payload = JSON.parse(body);
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+	const id = typeof payload === "object" && payload !== null && "id" in payload ? String(payload.id) : "";
+	const replay = await replayed(options, id, namespace.Instant.fromEpochMilliseconds((seconds + (options.tolerance ?? 300)) * 1e3));
+	if (replay) return err(replay);
+	return ok({
+		id,
+		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+		payload,
+		body
+	});
+}
+/**
+* `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret)
+* })`: stores Stripe events keyed by their event id.
+*/
+function stripeInboxVerify(secrets, options = {}) {
+	return async (request, body) => {
+		const verified = await verifyStripeWebhook({
+			headers: request.headers,
+			body
+		}, secrets, options);
+		return verified.ok ? ok({
+			id: verified.data.id,
+			payload: verified.data.payload
+		}) : verified;
+	};
+}
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+function hookError(status, message) {
+	return { error: {
+		http_code: status,
+		message
+	} };
+}
+/**
+* A `(request) => Response` handler for a Supabase Auth hook: verifies the
+* Standard Webhooks signature, types the payload and serializes the answer.
+*
+* ```ts
+* export const POST = authHook(
+*   "custom_access_token",
+*   env.AUTH_HOOK_SECRET,
+*   async ({ claims, user_id }) => ({
+*     claims: { ...claims, tenant_id: await organizationFor(user_id) },
+*   }),
+* );
+* ```
+*/
+function authHook(_kind, secret, handler, options) {
+	return async (request) => {
+		const verified = await verifyWebhook(request, secret, options);
+		if (!verified.ok) return Response.json(hookError(verified.error.status, verified.error.message), { status: verified.error.status });
+		try {
+			const answer = await handler(verified.data.payload, verified.data);
+			const status = "error" in answer ? answer.error.http_code : 200;
+			return Response.json(answer, { status });
+		} catch (cause) {
+			console.error("better-supabase: auth hook failed", cause);
+			return Response.json(hookError(500, "Hook failed"), { status: 500 });
+		}
+	};
+}
+function isDatabaseWebhook(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const payload = value;
+	return (payload["type"] === "INSERT" || payload["type"] === "UPDATE" || payload["type"] === "DELETE") && typeof payload["table"] === "string" && typeof payload["schema"] === "string";
+}
+/**
+* Reads a database webhook payload for `table` as an app-cased change. Returns
+* `null` for other tables or payloads that aren't database webhooks.
+*/
+function databaseChange(betterSupabase, table, payload) {
+	const meta = betterSupabase.meta.tables[table];
+	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
+	return {
+		type: payload.type,
+		table,
+		record: payload.record ? toApp(meta, payload.record) : null,
+		oldRecord: payload.old_record ? toApp(meta, payload.old_record) : null
+	};
+}
+//#endregion
+export { signStripeWebhook as a, isDatabaseWebhook as i, databaseChange as n, stripeInboxVerify as o, hookError as r, verifyStripeWebhook as s, authHook as t };

package/dist/verify-BTAEsJbF.d.ts

@@ -0,0 +1,146 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result } from "./result-mijqfoJN.js";
+import { B as TableKey, N as Row, a as AnyModels, i as AnyFunctions } from "./types-DmshMaXz.js";
+import { t as BetterSupabase } from "./define-D0LSXmUP.js";
+import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-CzqfLlfV.js";
+//#region src/blocks/webhooks/verify.d.ts
+/** The `Stripe-Signature` header for `body`, for tests and local replays. */
+declare function signStripeWebhook(secret: string, body: string, timestamp?: Temporal.Instant): Promise<string>;
+/**
+ * Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
+ * `whsec_…` secret and parses the event. Pass several secrets while rolling the
+ * endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
+ */
+declare function verifyStripeWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/**
+ * `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret)
+ * })`: stores Stripe events keyed by their event id.
+ */
+declare function stripeInboxVerify(secrets: string | readonly string[], options?: VerifyOptions): (request: Request, body: string) => Promise<Result<{
+  id: string;
+  payload: unknown;
+}>>;
+interface HookUser {
+  readonly id: string;
+  readonly email?: string;
+  readonly phone?: string;
+  readonly app_metadata?: Readonly<Record<string, unknown>>;
+  readonly user_metadata?: Readonly<Record<string, unknown>>;
+  readonly [key: string]: unknown;
+}
+interface AuthHookError {
+  readonly error: {
+    readonly http_code: number;
+    readonly message: string;
+  };
+}
+interface AuthHooks {
+  custom_access_token: {
+    input: {
+      readonly user_id: string;
+      readonly claims: Readonly<Record<string, unknown>> & {
+        readonly sub: string;
+        readonly role: string;
+      };
+      readonly authentication_method: string;
+    };
+    output: {
+      readonly claims: Readonly<Record<string, unknown>>;
+    };
+  };
+  send_email: {
+    input: {
+      readonly user: HookUser;
+      readonly email_data: {
+        readonly token: string;
+        readonly token_hash: string;
+        readonly redirect_to: string;
+        readonly email_action_type: string;
+        readonly site_url: string;
+        readonly token_new: string;
+        readonly token_hash_new: string;
+        /** Auth adds fields over time (`old_email`, `factor_type`, ...). */
+        readonly [key: string]: unknown;
+      };
+    };
+    output: Record<never, never>;
+  };
+  send_sms: {
+    input: {
+      readonly user: HookUser;
+      readonly sms: {
+        readonly otp: string;
+      };
+    };
+    output: Record<never, never>;
+  };
+  mfa_verification_attempt: {
+    input: {
+      readonly factor_id: string;
+      readonly factor_type: string;
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+    };
+  };
+  password_verification_attempt: {
+    input: {
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+      readonly should_logout_user?: boolean;
+    };
+  };
+  before_user_created: {
+    input: {
+      readonly metadata: Readonly<Record<string, unknown>>;
+      readonly user: HookUser;
+    };
+    output: Record<never, never>;
+  };
+}
+type AuthHookKind = keyof AuthHooks;
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+declare function hookError(status: number, message: string): AuthHookError;
+/**
+ * A `(request) => Response` handler for a Supabase Auth hook: verifies the
+ * Standard Webhooks signature, types the payload and serializes the answer.
+ *
+ * ```ts
+ * export const POST = authHook(
+ *   "custom_access_token",
+ *   env.AUTH_HOOK_SECRET,
+ *   async ({ claims, user_id }) => ({
+ *     claims: { ...claims, tenant_id: await organizationFor(user_id) },
+ *   }),
+ * );
+ * ```
+ */
+declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
+interface DatabaseWebhookPayload {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly schema: string;
+  readonly record: Readonly<Record<string, unknown>> | null;
+  readonly old_record: Readonly<Record<string, unknown>> | null;
+}
+interface DatabaseChange<R> {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly record: R | null;
+  readonly oldRecord: Partial<R> | null;
+}
+declare function isDatabaseWebhook(value: unknown): value is DatabaseWebhookPayload;
+/**
+ * Reads a database webhook payload for `table` as an app-cased change. Returns
+ * `null` for other tables or payloads that aren't database webhooks.
+ */
+declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
+//#endregion
+export { DatabaseWebhookPayload as a, hookError as c, stripeInboxVerify as d, verifyStripeWebhook as f, DatabaseChange as i, isDatabaseWebhook as l, AuthHookKind as n, authHook as o, AuthHooks as r, databaseChange as s, AuthHookError as t, signStripeWebhook as u };

package/dist/view-CKzCp8FW.d.ts

@@ -0,0 +1,90 @@
+import { b as DbError } from "./result-mijqfoJN.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-D57oDWNr.js";
+import { a as SessionActor, o as SessionDelegation } from "./actor-CoveJgya.js";
+import { n as Impersonator } from "./impersonation-YTa9dZUv.js";
+import { n as AmrEntry, t as Aal } from "./mfa-Dt8AdWht.js";
+import { JWTClaims, UserClaims } from "@supabase/server";
+//#region src/auth/view.d.ts
+/**
+ * The verified caller as plain data: no token, no clients. Safe to return from
+ * a `'use cache: private'` function and to pass to Client Components.
+ */
+type AuthSession<C = unknown, P = unknown> = {
+  readonly kind: "user";
+  /**
+   * Read from the verified claims (`sub`, `email`, `role`, `app_metadata`,
+   * `user_metadata`), never from the user object in the cookie, so it is
+   * the same with `tokens-only` cookies. Call `auth.getUser()` when a flow
+   * must see a revoked or changed user.
+   */
+  readonly user: UserClaims;
+  /**
+   * The verified JWT payload, including custom access token hook claims,
+   * typed and validated by `betterSupabase.claims(schema)`.
+   */
+  readonly claims: JWTClaims & C;
+  /** Seconds since epoch, from the token's `exp`. */
+  readonly expiresAt: number | null;
+  /**
+   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`, for
+   * display. Absent without a schema or when the metadata fails it. Users
+   * write this data with `auth.updateUser()`: never base access on it.
+   */
+  readonly profile?: P;
+  /** `aal2` once the user verified a second factor in this session. */
+  readonly aal: Aal;
+  /**
+   * Signed in with `signInAnonymously()` (the `is_anonymous` claim). Guards
+   * refuse these users unless `allow` lists `'anonymous'`; `'anon'` means
+   * no session and never admits them.
+   */
+  readonly anonymous: boolean;
+  /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
+  readonly amr: readonly AmrEntry[];
+  /**
+   * Set when an admin acts as this user in a support session or an
+   * impersonated session (`act.kind`), for a banner. Matches `actor`.
+   */
+  readonly impersonator?: Impersonator;
+  /**
+   * Who acts for the user: an OAuth client or agent (`client_id`, or an
+   * `act` chain without `kind`), a support session or an impersonated
+   * session, read from the `act` and `client_id` claims.
+   */
+  readonly actor?: SessionActor;
+  /**
+   * The scopes the user granted an `oauth-client` actor (or an `agent` on a
+   * token with a `scope`), without the OpenID identity scopes in
+   * `IDENTITY_SCOPES`, plus its `act` chain. Never set for a support or
+   * impersonated session.
+   */
+  readonly delegation?: SessionDelegation;
+} | {
+  readonly kind: "service";
+  readonly keyName: string;
+} | {
+  readonly kind: "apiKey";
+  readonly keyId: string;
+  readonly name: string;
+  readonly organizationId?: string;
+  readonly userId?: string;
+  readonly scopes: readonly string[];
+  /** Seconds since epoch, when the key was created. */
+  readonly createdAt?: number;
+  /** The user who created the key. */
+  readonly createdBy?: string;
+} | {
+  readonly kind: "anon";
+  readonly reason: AnonReason;
+} | {
+  readonly kind: "invalid";
+  readonly reason: InvalidReason;
+  readonly error: DbError;
+};
+type AnonReason = Extract<AuthState, {
+  kind: "anon";
+}>["reason"];
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
+//#endregion
+export { toSession as n, AuthSession as t };